coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden SBOM retries and align hub evidence
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 21s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f
This commit is contained in:
tegwick 2026-08-22 22:51:13 +02:00
parent 0f573c4378
commit 3b3e1a1ff0
17 changed files with 941 additions and 140 deletions
Download patch file Download diff file Expand all files Collapse all files

23
activity-definitions/daily-sbom-catchup.md
View file

@ -79,15 +79,24 @@ The progress event names the repos selected, updated, and skipped with a
reason (`no-checkout`, `no-manifest`, `ingest-error`), plus the fleet counters
so `never_count` can be watched declining day over day.
## Bounded side-effect (ACTIVITY-WP-0030-T02)
## Bounded side-effect (ACTIVITY-WP-0030-T02 / ACTIVITY-WP-0033)
`params.apply: true` calls sbom-nexus for each of the already-truncated N
targets. A target with an explicitly unavailable checkout is recorded through
`params.apply: true` declares the write, but context resolution remains
read-only. The workflow records the already-truncated N targets in Temporal
history, then a dedicated activity applies exactly that fixed set. Completed
per-repository outcomes are heartbeated so an ordinary activity retry resumes
after them instead of selecting or writing a second batch.
A target with an explicitly unavailable checkout is recorded through
`POST /sbom/{slug}/skip` as `no-checkout`; other targets use the terminal ingest
route, which returns `ingested`, `no-manifest`, or `ingest-error`. Transport and
contract failures are recorded as `ingest-error`. The resulting `updated` and
`skipped` arrays are part of the run context and progress report. There is no
task or issue emission.
route, which returns `ingested`, `no-manifest`, or `ingest-error`. Each request
sends a stable per-run/per-repository `Idempotency-Key`. Transport failures,
timeouts, and malformed responses fail visibly and are never converted into a
synthetic skip because the remote write may have committed. Nexus must enforce
the operation key to close the remaining crash window between a committed POST
and Activity Core's next heartbeat. The resulting `updated` and `skipped`
arrays are part of the run context and progress report. There is no task or
issue emission.
## Enable checklist